[TLS] doubt - what to do if a CA do not renew their expired cert?
M K Saravanan <mksarav@gmail.com> Fri, 31 March 2023 15:20 UTC
Return-Path: <mksarav@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65B31C14CE46 for <tls@ietfa.amsl.com>; Fri, 31 Mar 2023 08:20:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.097
X-Spam-Level:
X-Spam-Status: No, score=-7.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y7Wz8jh_0OOd for <tls@ietfa.amsl.com>; Fri, 31 Mar 2023 08:20:05 -0700 (PDT)
Received: from mail-oi1-x229.google.com (mail-oi1-x229.google.com [IPv6:2607:f8b0:4864:20::229]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2370AC1516F3 for <tls@ietf.org>; Fri, 31 Mar 2023 08:20:05 -0700 (PDT)
Received: by mail-oi1-x229.google.com with SMTP id w13so5524385oik.2 for <tls@ietf.org>; Fri, 31 Mar 2023 08:20:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; t=1680276004; x=1682868004; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=nn9PffGDSdDk9IPscfrqo1EFavIcjtcZvFkdUoLlLr8=; b=qPdQJ+dVt2e50yWIG8pnb6wr27yfE0keUgX9Sm0k03VNElFNepvwMw4nv7bwfGmPLk 5CnW6efBUIX4CDA0qC5fqSjpx0TwFe7sAv4VrJbdvBd2YIzE2lN2/H0/Qs4ma66plUEj tw8HlL7ugEoRFRC2YNAeKy3ScD+QzizO91PrWKYJld/Ia5yo1lAFL1mgbdonhPUZrukF FIRy2hK1gu7/VeRCICZqkLJ6XblBPS4Bp8KRYSfn4J2dhS3zXejTZIBbZZDEHmYe8A3e SqE0Jdrw4nROdmd49E9S7avfELX1vBKz3NUzGeGmxqnCMKlQDWVcdW/FevbnO60npk3E GD4w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1680276004; x=1682868004; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=nn9PffGDSdDk9IPscfrqo1EFavIcjtcZvFkdUoLlLr8=; b=Y3Kfy9lQM6RqfGkqMUt7YEROBr/3xhwU286usmHbyu9jkR7iBA4CFO4Qyu6CGG0eFz ++/XPP5HhDanHIaACG776pbJavOg9iemrfsVOGAkHkbbfqr7XYrTdMPQRSIz2w8iM5HX JcrcTDI6322V8NlI2q+kFv8LRTFATtHncl2R7PFHHE7L0QJnkwI76WuVjuoETnBOdkqv s3s3QiAbd+F4OezcszytGepaY45E3d+eg6HHFDx/4STT4+SeVWpmWW5XV6zOkxEwK2wl ivdTdWtp6tz50AndlDxAhRTXm0S6zhuLsVcO4BP8/p4ZHiqqKTnWGSbiYI2LkiXzX/R1 1qCA==
X-Gm-Message-State: AO0yUKUtD5Y09tQ0EobhzquFCRwfgv62cMjWtWNvGMUk+H0MgTwFGsRt EyUzR8DICAGwVU5OXXbpt/l7QWY05k0EWBgd4ZPDiWd2yqnGYTxw
X-Google-Smtp-Source: AK7set/pHVeqWRG5d6vMH8QqnwbJCxRMyhB6rMe+KLt/W6091g5bS/8bxjxIjgvJ1PcKSX/JLP4puCruE13xL/38E9Y=
X-Received: by 2002:a05:6808:1794:b0:36e:f6f5:66a2 with SMTP id bg20-20020a056808179400b0036ef6f566a2mr8682393oib.8.1680276003779; Fri, 31 Mar 2023 08:20:03 -0700 (PDT)
MIME-Version: 1.0
From: M K Saravanan <mksarav@gmail.com>
Date: Fri, 31 Mar 2023 23:19:54 +0800
Message-ID: <CAG5P2e9VuCZuO_fu65+adyMU1SzgbXrYerb98W63ZWDB2_2HmQ@mail.gmail.com>
To: "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000547d0005f833be1a"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/0NY5mOEaaRHB2Ehm37pU5wekRco>
Subject: [TLS] doubt - what to do if a CA do not renew their expired cert?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2023 15:20:07 -0000
Hi,
I have a layman doubt.
While working on a project, recently I discovered a list of CA cert which
got expired. I am not responsible for sites using those cert. But my end
users said sites using those certs are failing due to expired cert. So I
visited the official CA website to download the latest renewed certificate,
but I am unable to find any.
In such cases what to do? SInce all sites using them will start failing.
Is it not the duty of the CA to issue the renewed cert well in advance to
their customers?
one e.g.
Subject: C=TR, L=Istanbul, O=Isimtescil Bilisim Anonim Sirketi, OU=SSL
Department, CN=TrustSafe Domain Validated CA
-------------
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 6493029426882832914 (0x5a1bdfdcb9826a12)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=TR, L=Ankara, O=E-Tu\xC4\x9Fra EBG Bili\xC5\x9Fim
Teknolojileri ve Hizmetleri A.\xC5\x9E., OU=E-Tugra Sertifikasyon Merkezi,
CN=E-Tugra Certification Authority
Validity
Not Before: Dec 27 11:19:37 2018 GMT
Not After : Mar 3 12:09:48 2023 GMT
Subject: C=TR, L=Istanbul, O=Isimtescil Bilisim Anonim Sirketi,
OU=SSL Department, CN=TrustSafe Domain Validated CA
---------------
This got expired on 3 Mar 2023, but I am unable to find the renewed cert on
the CA website (e-tugra).
what to do in such cases?
with regards,
Saravanan
- [TLS] doubt - what to do if a CA do not renew the… M K Saravanan